CVE-2024-42304

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42304
In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow. ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported. After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash. Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1 Patch
https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a Patch
https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac Patch
https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5 Patch
https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe Patch
https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136 Patch
https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa Patch
https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Oct 2025, 20:26

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1 - () https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1 - Patch
References () https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a - () https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a - Patch
References () https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac - () https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac - Patch
References () https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5 - () https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5 - Patch
References () https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe - () https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe - Patch
References () https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136 - () https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136 - Patch
References () https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa - () https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa - Patch
References () https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 - () https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 - Patch

19 Aug 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: asegúrese de que el primer bloque de directorio no sea un agujero. El syzbot construye un directorio que no tiene bloque de directorios pero que no está en línea, es decir, el primer bloque de directorio es un agujero. Y no se informan errores al crear archivos en este directorio en el siguiente flujo. ext4_mknod ... ext4_add_entry // Leer bloque 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // El primer bloque de directorio es un agujero // Pero escriba == DIRENT, por lo que no se informa ningún error. Después de eso, obtenemos un bloque de directorio sin '.' y '..' pero con un dentry válido. Esto puede provocar que algún código que depende de punto o punto punto (como make_indexed_dir()) falle. Por lo tanto, cuando ext4_read_dirblock() encuentra que el primer bloque de directorio es un agujero, informa que el sistema de archivos está dañado y devuelve un error para evitar cargar datos corruptos desde el disco y causar algo malo.

19 Aug 2024, 05:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a -
  • () https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe -
  • () https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136 -
  • () https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa -

17 Aug 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-17 09:15

Updated : 2025-10-07 20:26

NVD link : CVE-2024-42304

Mitre link : CVE-2024-42304

CVE.ORG link : CVE-2024-42304

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo